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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 

WILLIE CACHO, M.D., ) 

Commander, U.S. Public Health Service ) 

) 
Plaintiff, ) C.A. No. 1:06CV00292 (ESH) 

) 
V. ) 

) 
THE HONORABLE MICHAEL CHERTOFF ) 
Secretary, Department of Homeland Security ) 

) 
Defendant. ) 

) 

DEFENDANT'S RESPONSE TO PLAINTIFF'S SURREPLY 

Plaintiff sought and was given permission to address the "new" argument made by defendant 
in defendant's reply to plaintiffs opposition to defendant's dispositive motion. Defendant was 
permitted to respond to plaintiff's surreply. Minute Order of 9/26/06. 

The only new argument in defendant's reply relates to the withdrawal of defendant's 
concession, for the purpose of his dispositive motion, that plaintiff could prove the first prong of the 
Privacy Act test. That prong requires plaintiff to show that the disclosed information at issue was a 
"record" contained within a "system of records."' In his opposition, plaintiff only established that the 
disclosed information was the absence of a record. As plaintiff failed to carry his burden of showing 
a "record" was disclosed in his opposition, defendant withdrew his concession and addressed 
plaintiff's failure in his reply. Plaintiff was given a "consented to" opportunity to respond to 
defendant's argument in a surreply and defendant was permitted to respond. 



1 See Fisher v. National Institutes of Health . 934 F. Supp. 464, 468, (D.D.C. 1996), aff'd . 107 F.3d 
922, 1996 WL 734079 (D.C. Cir. 1996). The four prongs are:"(l) the disclosed information is a 
'record' contained with a 'system of records'; (2) the agency improperly disclosed the information; 
(3) the disclosure was willful or intentional; and (4) the disclosure adversely affected the plaintiff." 
(Emphasis added). Logan v. Department of Veterans Affairs . 357 F.Supp.2d 149, 154 (D.D.C. 2004) 
{citing Fisher v. National Institutes of Health , supra) . As set forth in defendant's opening brief, 
plaintiff has failed to meet any of these essential elements. 
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Defendant's response is in two parts: Part I addresses plaintiffs assertion that he has met the 
first prong of the Privacy Act test; Part II responds to the other arguments plaintiff makes in his 
surreply. 

I. 

The totality of plaintiff's surreply addressing defendant's "new" argument is found at pages 1- 
2 of his surreply. Plaintiff relies on the definition of "information" in Webster's Collegiate 
Dictionary, Eleventh Edition, 2003, to establish that, in his view, a disclosure of a record equates to 
obtaining knowledge of information." He concludes that "[Commander Sokolowski] learned [from 
the medical record] that CDR Cacho had not listed a [disqualifying] medical condition and a 
medication for that condition on his most recent flight physical . . ." and this was "clearly disclosed 
'information' obtained from a record . . ." Plaintiff's Reply at 1-2. The plain language of the 
definitions found in the statute, 5 U.S.C. § 552a, belies this rationale. 

In order to make out a prima facie case for an improper disclosure of information in violation 
of the Privacy Act, a plaintiff must establish that: "the disclosed information is a 'record' contained 
with a 'system of records.'" Fisher v. National Institutes of Health , 934 F. Supp. at 468. The statute 
defines a "record" as "any item, collection, or grouping of information about an individual that is 
maintained by an agency, including . . . medical history, . . . that contains his name, or the identifying 
number, symbol, or other identifying particular assigned to the individual, such as a finger or voice 
print or a photograph." 5 U.S.C. § 552a(a)(4). The statute defines "system of records" as a "group of 
records . . . from which information is retrieved by the name of the individual or by some identifying 
number, symbol, or other identifying particular assigned to the individual." 5 U.S.C. §552a(a)(5). 



^ This is in furtherance of plaintiff ' s new argument discussed in Part II that improper access is 
sufficient to establish a violation of the Privacy Act. 



Case 1 :06-cv-00292-ESH Document 21 Filed 1 0/1 0/2006 Page 3 of 1 

The Privacy Act only places conditions on the disclosure of records, not on the disclosure of the 
absence of a record or information. 5 U.S.C. § 552a(b). Indeed, there is nothing in the plain 
language of 5 U.S.C. § 552a(a)(Definition) or (b)(Conditions of disclosure) that supports plaintiff's 
position that the disclosure of the absence of information is within the Privacy Act's limited waiver 
of sovereign immunity. 

It is well settled that, "[t]he meaning of the statute must, in the first instance, be sought in the 
language of the statute itself. If the language is clear and unambiguous, a court must give effect to its 
plain meaning." Grachow v. United States Customs Service . 504 F. Supp. 632, 634 (D.D.C. 1980). 
As a waiver of sovereign immunity, the Privacy Act is to be strictly construed in favor of the 
sovereign. See United States v. Nordic Village, Inc. , 503 U.S. 30, 34 (1992); Library of Congress v. 
Shaw, 478 U.S. 310, 318 (1986); McMahon v. United States . 342 U.S. 25, 27 (1951). The 
construction of the statute favoring the sovereign must be followed as long as it is "plausible." 
Nordic Village , 503 U.S. at 37. The rule of strict construction applies. Monark Boat Company v. 
NLRB . 708 F.2d 1322, 1327 (8* Cir. 1983) (rejecting argument that Equal Access to Justice Act 
should be broadly construed because of its remedial character, in favor of strict construction as a 
waiver of sovereign immunity), cited with approval in In re Nofziger , 938 F.2d 1397, 1403 (D.C. Cir. 
1991); see also Tomasello v. Rubin . 167 F.3d 612, 617-18 (D.C. Cir. 1999); cf. Lane v. Pena . 518 
U.S. 187, 192 (1996)(applying strict construction to waiver of sovereign immunity in case brought 
under the Rehabilitation Act of 1973, 29 U.S.C. §§ 791-794); Martin v. Sec'vof HHS . 62 F.3d 1403, 
1405 (Fed. Cir. 1995) (same with respect to case brought under National Childhood Vaccine Injury 
Act, 42 U.S.C. § 300aa-l to -34). 
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Accordingly, because plaintiff's cause of action is based on an alleged disclosure of the 
absence of information in his medical record, not a record as defined by the Privacy Act, his cause of 
action should be dismissed. 

II. 

The remainder of plaintiff's surreply focuses on his new position that he can establish a prima 
facie Privacy Act cause of action, based on improper disclosure of Privacy Act records, by merely 
showing that CDR Sokolowski improperly accessed his medical record.^ This argument should be 
ignored by the Court, as untimely, as the parties are required to raise all of their affirmative 
arguments in their opening briefs. See Corson & Gruman Co. v. Natl Labor Relations Bd. , 899 F.2d 
47, 50n. 4(D.C.Cir.l990). 

In support of his new argument, plaintiff cites Bigelow v. POD , 217 F.3"' 875 (B.C. Cir. 
2000), cert, denied . 532 U.S. 971 (2001), and then asserts that-like the Health Insurance Portability 
and Accountability Act of 1996 ("HIPAA"), 42 U.S.C. § 1320d through d-8, as implemented by 45 
C.F.R. Part 164, where improper use is sufficient to establish a violation-a violation of the Privacy 
Act based on improper disclosure can be established merely by showing that CDR Sokolowski 
improperly accessed his medical record. The Coast Guard will demonstrate that Bigelow does not 
provide any support for plaintiff's position, then, as it did in its Reply to Plaintiff's Opposition, the 
Coast Guard will address the argument that plaintiff can establish a Privacy Act violation based on 
improper disclosure by focusing on CDR Sokolowski and his access to plaintiff's medical record. 



^ In his Complaint, plaintiff alleges that CDR Sokolowski improperly disclosed Privacy 
Act records to others at the Air Station Miami clinic, around late June 2004. R. 1 at 1[ 13. 
CDR Sokolowski only disclosed the absence of records to CDR Gordon and LT Jarvi. 
Any additional disclosures were made by plaintiff himself or resulted from plaintiff's 
disclosures to Health program personnel at Coast Guard Headquarters and the 
Maintenance and Logistics Command. 
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rather than focusing on the agency officials to whom disclosures were made, CDR Gordon and LT 
Jarvi, and their need to know. 

Plaintiffs citation to Bigelow is misguided. Bigelow did not simply involve a situation in 
which an agency official allegedly improperly accessed personal information. In that case, the court 
found that Bigelow' s superior. Colonel Noyes, went to the Joint Staff Security Office and requested 
Bigelow' s personal security file. 217 F.3d at 876. After reviewing Bigelow' s personal security file. 
Colonel Noyes referred the matter to the Air Force for disciplinary action. Id. Accordingly, in the 
Bigelow case, there arguably was an improper agency disclosure when the Joint Staff Security Office 
provided records to Colonel Noyes, and again when Colonel Noyes referred the matter to the Air 
Force for disciplinary action. The court in Bigelow ultimately held that Colonel Noyes had a need to 
know the information disclosed to him by the Joint Staff Security Office and, therefore, the 
disclosure was not improper. Id. Bigelow does not stand for the proposition that a Privacy Act cause 
of action can be established merely by showing that an agency official improperly accessed personnel 
information. As the Coast Guard noted in its reply to CDR Cacho's opposition, it appears that CDR 
Cacho is confusing a HIPAA violation with a Privacy Act cause of action. Improper access to 
personal health information may be sufficient to establish a HIPAA violation, but HIPAA does not 
create a private cause of action for such a violation. Reply at 3, footnote 1 and related text. Improper 
access to personal health information, by itself, is not sufficient to allege a Privacy Act cause of 
action. 

For one thing, a cause of action under 5 U.S.C. § 552a(g)(l)(D) requires that the agency fail 
to comply with the Privacy Act "in such a way as to have an adverse effect on an individual." In 
other words, in a case like CDR Cacho's, the plaintiff must prove that the improper disclosure caused 
actual damages to the individual. In Bigelow , it appears that the plaintiff's alleged damages resulted 

5 
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from the disciplinary action that was taken against him based on Colonel Noyes's referral of the 
matter to the Air Force for disciplinary action. 217 F.3d at 876. Therefore, the disclosure that would 
have been actionable, if it was improper, was Colonel Noyes's disclosure of Privacy Act records to 
the Air Force for disciplinary action. 

Likewise, in this case, even if CDR Sokolowski's allegedly improper accessing of 
CDR Cacho's medical record could be considered an improper disclosure, there is no evidence that 
by itself that disclosure had any adverse effect on CDR Cacho. It was only after CDR Sokolowski 
made disclosures to CDR Gordon and LT Jarvi that CDR Cacho learned that CDR Sokolowski had 
accessed his medical record. If the disclosures to CDR Gordon and LT Jarvi were not improper, then 
any adverse effect resulting from those disclosures is not a basis for a Privacy Act cause of action. 
And as the Coast Guard has previously demonstrated in its opening brief, the adverse effects that 
CDR Cacho has suffered resulted from his own disclosure of his failure to timely report his medical 
condition, and that he was taking medications for it, not from any disclosures originating with 
CDR Sokolowski. 

In addition to improperly citing Bigelow for support, plaintiff argues without any other 

authority, that he can establish a Privacy Act violation, based on improper disclosure, by showing 

that CDR Sokolowski improperly accessed his medical record, and without showing any further 

disclosure. At page 3 of his Surreply, plaintiff states: "To establish a prima facie case of improper 

disclosure, it is enough to show that CDR Sokolowski unlawfully or improperly accessed CDR 

Cacho's personal health information. Bigelow , supra ." In summation at page 5 of the Surreply, 

plaintiff states: 

In sum, CDR Sokolowski was authorized to review only CDR Cacho's medical record within 
the specified parameters of the QA review. Investigation found that he exceeded those 
parameters and did so intentionally and willfully. The Privacy Act is designed to prevent 
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exactly the type of search of confidential medical records that CDR Sokolowski undertook in 
this case. 

Surreply at 5. 

As the Coast Guard noted in its Reply to Plaintiff's Opposition, Reply at 3-7, plaintiff has 
failed to establish that there was an improper disclosure in violation of the Privacy Act, and he is 
confusing the Privacy Act with HIPAA. The quotations above state the basis for establishing a 
HIPAA violation for improper use of a medical record. 45 C.F.R. § 164.502. The Coast Guard 
found that CDR Sokolowski violated HIPAA and took appropriate action to address the violation. 
However, HIPAA does not provide a private cause of action. Reply at 3, footnote 1, and related text. 
The Privacy Act provides for a private cause of action, but such an action cannot be based on a mere 
improper use violation of HIPAA. 

Plaintiff alleges that his Privacy Act action is based on improper disclosure, but now he 
argues that he only needs to show that CDR Sokolowski improperly accessed his medical record. In 
its Reply to Plaintiff's Opposition, the Coast Guard pointed out that plaintiff was misguided or 
confused when he focused on CDR Sokolowski and his access to CDR Cacho's medical record, 
rather than the agency officials to whom disclosures were made and whether they had a need to 
know. Reply at 3-4. 

Plaintiff, in his Opposition, did not respond to the Coast Guard's position that Article 
10.A.4.a. of the Medical Manual authorized CDR Sokolowski to access CDR Cacho's medical 
record. Taking the opportunity now to try to cure that lapse, plaintiff claims that the intent of Article 
10.A.4.a. is to authorize limited access to medical records. Surreply at 4-5. The Coast Guard agrees 
that the intent of the provision as it applies to pharmacists is to "ensure[] the pharmacy staff has 
access to the necessary clinical information (age, weight, allergies, lab values, vital signs, etc.) to 

7 
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provide complete pharmaceutical care." Article 10.A.4.a., Medical Manual. But, while this section 
may suggest some limitations on the type of information a pharmacist should be looking for, it does 
not limit where in the medical record a pharmacist may look for information. Article 10.A.4.a. 
authorizes pharmacists to access a patient's entire medical record, without limitation as to where a 
pharmacist may look. The article lists information the Coast Guard wants to ensure that pharmacists 
have access to, and the "etc." in the list makes it clear that the list is not exhaustive. Plaintiffs 
interpretation of the intent of Article 10.A.4.a. is not supported by the plain text and is simply wrong. 
The Coast Guard reasonably interprets Article 10.A.4.a. to mean that a pharmacist, such as CDR 
Sokolowski, is authorized to access the entire medical record. 

Whereas Article 10.A.4.a. clearly authorizes a pharmacist such as CDR Sokolowski, to access 
medical records. Article 4.A.l.a.(6) of the Medical Manual describes one of the purposes of keeping 
medical records. The Coast Guard asserts that the Court can infer from that purpose that a 
pharmacist, as a quality assurance or medical records person, must have access to medical records to 
facilitate communications with health care providers in the clinic. This is consistent with the position 
the Coast Guard stated in its Dispositive motion at p. 6 and its reply, p. 4, n. 2. 

But as noted previously, for purposes of the element of plaintiff s Privacy Act cause of action 
requiring proof of an improper disclosure of a Privacy Act record, where, as here, the Coast Guard 
asserts that the disclosures were to agency officials with a need to know, the plain language of the 
Privacy Act, 5 U.S.C. § 55a(b)(l), focuses— not on the discloser and his authority to access records or 
his motive for making disclosures— but on the agency officials to whom disclosures were made and 
whether there was a need to know. Reply at 3-4. In its Dispositive motion, at 9, 13-17, and in its 
Reply to Plaintiffs Opposition, at 5, the Coast Guard has shown that both CDR Gordon and LT Jarvi 
were agency officials with a need to know the information disclosed by CDR Sokolowski. In its 

8 
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reply, the Coast Guard also demonstrated that there was no disclosure of Privacy Act records to 
Commander Marshall and no evidence of actual damages related to the alleged disclosure to 
Commander Marshall. Id. at 6-7. 

CDR Cacho is grasping at straws when he asserts that he has established a prima facie case if 
he can show that CDR Sokolowski improperly accessed his medical record. Bigelow does not state 
that merely reviewing a Privacy Act record is an improper disclosure. Neither does the fact that 
HIPAA limits use of medical records mean that showing improper access to a medical record is 
sufficient to establish a violation of the Privacy Act based on improper disclosure. If CDR Cacho 
cannot prove even one element of his Privacy Act cause of action, his opposition to the Coast 
Guard's motion must fail. 

III. Conclusion 

For the foregoing reasons, defendant respectfully requests that the complaint in this case be 

dismissed or summary judgment entered in defendant's behalf. 

Respectfully submitted, 

M 

JEFFREY A. TAYLOR , D.C. Bar # 498610 
United States Attorney 

/s/ 



RUDOLPH CONTRERAS, D.C. Bar # 434122 
Assistant United States Attorney 



/s/ 



CLAIRE WHITAKER, D.C. Bar # 354530 

Assistant United States Attorney 

United States Attorneys Office 

Civil Division 

555 4th Street, N.W., Room E-4204 

Washington, D.C. 20530 
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